---
type: resource-type
title: SecurityGroup
description: aws resource type AWS::EC2::SecurityGroup
name: SecurityGroup
lexicon: aws
resource_type: AWS::EC2::SecurityGroup
---
`AWS::EC2::SecurityGroup`, a resource type of the aws lexicon.

## Properties

- `GroupDescription` (`string`, required): A description for the security group.
- `GroupId` (`string`, optional): The group ID of the specified security group.
- `GroupName` (`string`, optional): The name of the security group.
- `Id` (`any`, optional): The group name or group ID depending on whether the SG is created in default or specific VPC
- `SecurityGroupEgress` (`SecurityGroup_Egress[]`, optional): [VPC only] The outbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
- `SecurityGroupIngress` (`SecurityGroup_Ingress[]`, optional): The inbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
- `Tags` (`SecurityGroup_Tag[]`, optional): Any tags assigned to the security group.
- `VpcId` (`string`, optional): The ID of the VPC for the security group.

## Attributes

- `GroupId`
- `Id`

## Governed by

- [WAW019](/rules/WAW019.md): Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)
- [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
- [WAW049](/rules/WAW049.md): Security group allows unrestricted ingress on a port other than ALB:80/443
- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time